CVE-2026-82262: Logto Server-Side Request Forgery via webhook test endpoint
Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that accepts arbitrary URLs without host validation. Tenant administrators with Management API tokens can make the server issue HTTP POST requests to internal URLs and retrieve response bodies from services on the private network.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a Management API token with tenant-administrator privileges. The vulnerable webhook test endpoint can then be used to make Logto send HTTP POST requests.
What systems are at risk from exploitation?
Services reachable from the Logto server's private network are exposed, because the endpoint accepts arbitrary target URLs without host validation. Response bodies from those internal services can be retrieved by the caller.
Are deployments running the affected version exposed by default?
The issue is present through Logto 1.42.0 in the POST /api/hooks/:id/test endpoint. Exploitation additionally requires a tenant-administrator Management API token.